From patchwork Sat Jun 18 13:44:27 2022
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: akuster808 <akuster808@gmail.com>
X-Patchwork-Id: 9313
X-Patchwork-Delegate: akuster808@gmail.com
Return-Path: <akuster808@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org
 (localhost.localdomain [127.0.0.1])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 4C9D1CCA473
	for <webhook@archiver.kernel.org>; Sat, 18 Jun 2022 13:44:49 +0000 (UTC)
Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com
 [209.85.216.48])
 by mx.groups.io with SMTP id smtpd.web10.9210.1655559879179826678
 for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:39 -0700
Authentication-Results: mx.groups.io;
 dkim=pass header.i=@gmail.com header.s=20210112 header.b=VDe2Xc23;
 spf=pass (domain: gmail.com, ip: 209.85.216.48,
 mailfrom: akuster808@gmail.com)
Received: by mail-pj1-f48.google.com with SMTP id
 h34-20020a17090a29a500b001eb01527d9eso5578827pjd.3
        for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:39 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20210112;
        h=from:to:subject:date:message-id:mime-version
         :content-transfer-encoding;
        bh=L6X42SzSHw6m9Hxe4nm13p4gQCU7cosoeaZRP/yhNd4=;
        b=VDe2Xc23P4mF6qtXPMiiEEau1vznNQ5aEuKi5YWU+9JCrlmBP6fsKbJdc2P32A1vyF
         M7o24mryx/LlZR4Jaimtz5UCa9avwrQWXNVFkMyeUBfK1K6mT8av7NAXDOnG84mHZIQ6
         3T+BKr8nL1pmoNoOD8GdmIoERwLibDLgoTUKSYM+QCobbME4znC93YZ1s0xeFitO5eia
         uxuuEe578X05CCh5+NTzs3GzM2z6eMG9Ax4JpFNowL9Pf1oWHAqd45H077bZSOTp09zv
         9ZKJdDAu+FYcVdHwojphlDTCBfyWpvQSufhk6ZnTu2QxlpOZnkqVCbiegRyaDbdBGyPL
         Lj3Q==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112;
        h=x-gm-message-state:from:to:subject:date:message-id:mime-version
         :content-transfer-encoding;
        bh=L6X42SzSHw6m9Hxe4nm13p4gQCU7cosoeaZRP/yhNd4=;
        b=1ysNwumXjvqeu8eIXT61J4wWAWhJ+uAWO7fpvbjQwA76VhG/hKZif/zcSBp9/HWA/j
         csewxkLwvq9xvPqEBKPAQhFMs1kEM/VDMrz4n6KO0mzf9YtFZryvjgcLapWV9ba8qUwT
         PWV8O0/TcAPOQgRA5CBfri69vYIsnN5OiVFXbNYyMc6yRJfulnhKDOsz9gXVPkRpf31k
         LnB41ErftceUrzfBVc6K1yWOvCI+flTK72pDoelV83PNPprZLBcwzx8PwaWG3JCUEk2g
         C6K6gzBePs76mhr1qifM5pI5PqsAIsMchJNed5x7GInwBMdYK8B9bF3Hq+r9rRUvd8Cx
         6SgA==
X-Gm-Message-State: AJIora/VMexf6DfliaYc1z5YBa0SBvaJJczGgSZkDOGUX9f6m0CxhJDl
	Lbd0VTYsP9jxG8cU/CBWpNRyRNlnCzk=
X-Google-Smtp-Source: 
 AGRyM1vgu9u7TOYPyLc7eqoFcbovekYh3OcKjvYxLciU99BlWpI3hkcwUj2UT2HSlKDpfQz0pSjiBA==
X-Received: by 2002:a17:902:8bc5:b0:168:cca6:1b29 with SMTP id
 r5-20020a1709028bc500b00168cca61b29mr14217648plo.129.1655559877999;
        Sat, 18 Jun 2022 06:44:37 -0700 (PDT)
Received: from keaua.hsd1.ca.comcast.net
 ([2601:202:4180:a5c0:b704:2c1c:4bb5:cab1])
        by smtp.gmail.com with ESMTPSA id
 o26-20020a63921a000000b00408a3724b38sm5689880pgd.76.2022.06.18.06.44.36
        for <yocto@lists.yoctoproject.org>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Sat, 18 Jun 2022 06:44:37 -0700 (PDT)
From: Armin Kuster <akuster808@gmail.com>
To: yocto@lists.yoctoproject.org
Subject: [meta-security][PATCH 1/9] security-test-image: auto include layers
 if present.
Date: Sat, 18 Jun 2022 06:44:27 -0700
Message-Id: <20220618134435.2370878-1-akuster808@gmail.com>
X-Mailer: git-send-email 2.25.1
MIME-Version: 1.0
List-Id: <yocto.lists.yoctoproject.org>
X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <yocto@lists.yoctoproject.org>; Sat, 18 Jun 2022 13:44:49 -0000
X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/57343

This is to simplify tesing to build one image and include pkgs depending on the
layers included in the BBLAYERS.

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 recipes-core/images/security-test-image.bb | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/recipes-core/images/security-test-image.bb b/recipes-core/images/security-test-image.bb
index 54d8978..133a7a1 100644
--- a/recipes-core/images/security-test-image.bb
+++ b/recipes-core/images/security-test-image.bb
@@ -4,7 +4,16 @@ require security-build-image.bb
 
 IMAGE_FEATURES += "ssh-server-openssh"
 
-TEST_SUITES = "ssh ping ptest apparmor clamav samhain sssd tripwire checksec smack suricata"
+IMAGE_INSTALL:append = "\
+    ${@bb.utils.contains("DISTRO_FEATURES", "smack", "smack-test", "",d)} \
+    ${@bb.utils.contains("BBFILE_COLLECTIONS", "tpm-layer", "packagegroup-security-tpm","", d)} \
+    ${@bb.utils.contains("BBFILE_COLLECTIONS", "tpm-layer", "packagegroup-security-tpm2","", d)} \
+    ${@bb.utils.contains("BBFILE_COLLECTIONS", "parsec-layer", "packagegroup-security-parsec","", d)} \
+    ${@bb.utils.contains("BBFILE_COLLECTIONS", "integrity", "packagegroup-ima-evm-utils","", d)} \
+"
+
+TEST_SUITES = "ssh ping apparmor clamav samhain sssd checksec smack suricata"
+TEST_SUITES:append = " parsec tpm2 swtpm ima"
 
 INSTALL_CLAMAV_CVD = "1"
 

From patchwork Sat Jun 18 13:44:28 2022
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: akuster808 <akuster808@gmail.com>
X-Patchwork-Id: 9316
X-Patchwork-Delegate: akuster808@gmail.com
Return-Path: <akuster808@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org
 (localhost.localdomain [127.0.0.1])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 61FD8CCA47F
	for <webhook@archiver.kernel.org>; Sat, 18 Jun 2022 13:44:49 +0000 (UTC)
Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com
 [209.85.214.179])
 by mx.groups.io with SMTP id smtpd.web08.9332.1655559880163913598
 for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:40 -0700
Authentication-Results: mx.groups.io;
 dkim=pass header.i=@gmail.com header.s=20210112 header.b=qQnqLjZn;
 spf=pass (domain: gmail.com, ip: 209.85.214.179,
 mailfrom: akuster808@gmail.com)
Received: by mail-pl1-f179.google.com with SMTP id d5so6033647plo.12
        for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:40 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20210112;
        h=from:to:subject:date:message-id:in-reply-to:references:mime-version
         :content-transfer-encoding;
        bh=yxLlLcKbvBZEKQebBVoSzHe1D9E6CBq0UpJ/4ijBfgE=;
        b=qQnqLjZn1HkxFDvYsecipWQMprEH7gAz/570vAV6+isdQxQBOPjckrSTM3q3aNMmQI
         ycR81fiq0tZbpbFx9KB4TnBM+j8QrhRbSRHFq0FsiS0hzkmI6Swoanmt7BKcOgw0HKD7
         1PxmTiZtFJ6XfeA0Tjs1k8MngrPf65ZC8K7ypxBaJTIFDm11bdcLD865qLXwQFBNc7aL
         M6Qt3D4rB4fxbegd6Y3ehD9Ib/1xgG4OMRfokeazeXzlKD6pbHzhy7gCutKJMUKCR4iJ
         mSNsjGRQ1E4qWbeDxCXVkldhPl7Zb/+FY9eSrJv5/1kfSPRX+CBWn7uc0F3UHgfonOkS
         jkAw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112;
        h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to
         :references:mime-version:content-transfer-encoding;
        bh=yxLlLcKbvBZEKQebBVoSzHe1D9E6CBq0UpJ/4ijBfgE=;
        b=f8ZwOFrIgn2FUy9W7JP/u+yp6jW+0qtzDtv2axKvtviEgyXm1DdYqQROb7ln8mp0ar
         evNVKgtbOFHkCj3lJwhv2FzzLZrfI2RvNCphBz9lTElD3UIDgVUenQp8rw9eO9rdQbUw
         iRQHTCbXBmchCoJEQioJZzIhNmvMX4lt5OuDdfmmotnkbvwWMHRXdpoBR/hO0pM4m0TO
         MiccFHqUhVKtY7mosAzczHUfNQR5xipTPYKj5IhbHGla8+sobAbSJCEf50v7BLHLo+la
         0DOEKMW5IH5jQhKUL69uFANjB+sX0b4QmnohI5aq24IZLsjccIuIrmb3cbjTvOmbhmEt
         8O0A==
X-Gm-Message-State: AJIora9qU69s2/SvyX+mv+7PAWqbJaz/c+XRyu77k2Sj1EBQ5JFXVk6n
	qX9YKjIWR7QVwdg0iEO5kdi3r8nCSAU=
X-Google-Smtp-Source: 
 AGRyM1uN2+mlxO1r26ePqF0qVKSSr56+IjXs6WiBNGm4x92NvEstVJeXWvDSPVfuF/2r/Jf47ZOIpQ==
X-Received: by 2002:a17:903:234f:b0:16a:30f:4a85 with SMTP id
 c15-20020a170903234f00b0016a030f4a85mr9190061plh.89.1655559879245;
        Sat, 18 Jun 2022 06:44:39 -0700 (PDT)
Received: from keaua.hsd1.ca.comcast.net
 ([2601:202:4180:a5c0:b704:2c1c:4bb5:cab1])
        by smtp.gmail.com with ESMTPSA id
 o26-20020a63921a000000b00408a3724b38sm5689880pgd.76.2022.06.18.06.44.38
        for <yocto@lists.yoctoproject.org>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Sat, 18 Jun 2022 06:44:38 -0700 (PDT)
From: Armin Kuster <akuster808@gmail.com>
To: yocto@lists.yoctoproject.org
Subject: [meta-security][PATCH 2/9] smack-test: more py3 covertion
Date: Sat, 18 Jun 2022 06:44:28 -0700
Message-Id: <20220618134435.2370878-2-akuster808@gmail.com>
X-Mailer: git-send-email 2.25.1
In-Reply-To: <20220618134435.2370878-1-akuster808@gmail.com>
References: <20220618134435.2370878-1-akuster808@gmail.com>
MIME-Version: 1.0
List-Id: <yocto.lists.yoctoproject.org>
X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <yocto@lists.yoctoproject.org>; Sat, 18 Jun 2022 13:44:49 -0000
X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/57344

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 recipes-mac/smack/smack-test/notroot.py              | 12 ++++++------
 .../smack/smack-test/smack_test_file_access.sh       | 10 +++++-----
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/recipes-mac/smack/smack-test/notroot.py b/recipes-mac/smack/smack-test/notroot.py
index f0eb0b5..89f83f4 100644
--- a/recipes-mac/smack/smack-test/notroot.py
+++ b/recipes-mac/smack/smack-test/notroot.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python
+#!/usr/bin/env python3
 #
 # Script used for running executables with custom labels, as well as custom uid/gid
 # Process label is changed by writing to /proc/self/attr/curent
@@ -9,8 +9,8 @@
 # """By  default,  each  user  in Debian GNU/Linux is given a corresponding group 
 # with the same name. """
 #
-# Usage: root@desk:~# python notroot.py <uid> <label> <full_path_to_executable> [arguments ..]
-# eg: python notroot.py 1000 User::Label /bin/ping -c 3 192.168.1.1
+# Usage: root@desk:~# python3 notroot.py <uid> <label> <full_path_to_executable> [arguments ..]
+# eg: python3 notroot.py 1000 User::Label /bin/ping -c 3 192.168.1.1
 #
 # Author: Alexandru Cornea <alexandru.cornea@intel.com>
 import os
@@ -28,6 +28,6 @@ try:
 	os.setuid(uid)	
 	os.execv(path,sys.argv)
 
-except Exception,e:
-	print e.message
-	sys.exit(1)
+except Exception as e:
+	print(e.strerror)
+	sys.exit(-1)
diff --git a/recipes-mac/smack/smack-test/smack_test_file_access.sh b/recipes-mac/smack/smack-test/smack_test_file_access.sh
index 5a0ce84..598f1df 100644
--- a/recipes-mac/smack/smack-test/smack_test_file_access.sh
+++ b/recipes-mac/smack/smack-test/smack_test_file_access.sh
@@ -8,7 +8,7 @@ CAT=`which cat`
 ECHO=`which echo`
 uid=1000
 initial_label=`cat /proc/self/attr/current`
-python $TMP/notroot.py $uid "TheOther" $ECHO 'TEST' > $test_file
+python3 $TMP/notroot.py $uid "TheOther" $ECHO 'TEST' > $test_file
 chsmack -a "TheOther" $test_file
 
 #        12345678901234567890123456789012345678901234567890123456
@@ -17,7 +17,7 @@ rule_ro="TheOne                  TheOther                r----"
 
 # Remove pre-existent rules for "TheOne TheOther <access>"
 echo -n "$delrule" > $SMACK_PATH/load
-python $TMP/notroot.py $uid "TheOne" $CAT $test_file 2>&1 1>/dev/null | grep -q "Permission denied" || RC=$?
+python3 $TMP/notroot.py $uid "TheOne" $CAT $test_file 2>&1 1>/dev/null | grep -q "Permission denied" || RC=$?
 if [ $RC -ne 0 ]; then
 	echo "Process with different label than the test file and no read access on it can read it"
 	exit $RC
@@ -25,7 +25,7 @@ fi
 
 # adding read access
 echo -n "$rule_ro" > $SMACK_PATH/load
-python $TMP/notroot.py $uid "TheOne" $CAT $test_file | grep -q "TEST" || RC=$?
+python3 $TMP/notroot.py $uid "TheOne" $CAT $test_file | grep -q "TEST" || RC=$?
 if [ $RC -ne 0 ]; then
 	echo "Process with different label than the test file but with read access on it cannot read it"
 	exit $RC
@@ -36,7 +36,7 @@ echo -n "$delrule" > $SMACK_PATH/load
 # changing label of test file to *
 # according to SMACK documentation, read access on a * object is always permitted
 chsmack -a '*' $test_file
-python $TMP/notroot.py $uid "TheOne" $CAT $test_file | grep -q "TEST" || RC=$?
+python3 $TMP/notroot.py $uid "TheOne" $CAT $test_file | grep -q "TEST" || RC=$?
 if [ $RC -ne 0 ]; then
 	echo  "Process cannot read file with * label"
 	exit $RC
@@ -45,7 +45,7 @@ fi
 # changing subject label to *
 # according to SMACK documentation, every access requested by a star labeled subject is rejected
 TOUCH=`which touch`
-python $TMP/notroot.py $uid '*' $TOUCH $TMP/test_file_2
+python3 $TMP/notroot.py $uid '*' $TOUCH $TMP/test_file_2
 ls -la $TMP/test_file_2 2>&1 | grep -q 'No such file or directory' || RC=$?
 if [ $RC -ne 0 ];then
 	echo "Process with label '*' should not have any access"

From patchwork Sat Jun 18 13:44:29 2022
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: akuster808 <akuster808@gmail.com>
X-Patchwork-Id: 9317
X-Patchwork-Delegate: akuster808@gmail.com
Return-Path: <akuster808@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org
 (localhost.localdomain [127.0.0.1])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 56CE6CCA481
	for <webhook@archiver.kernel.org>; Sat, 18 Jun 2022 13:44:49 +0000 (UTC)
Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com
 [209.85.214.179])
 by mx.groups.io with SMTP id smtpd.web08.9332.1655559880163913598
 for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:41 -0700
Authentication-Results: mx.groups.io;
 dkim=pass header.i=@gmail.com header.s=20210112 header.b=ops4BW6+;
 spf=pass (domain: gmail.com, ip: 209.85.214.179,
 mailfrom: akuster808@gmail.com)
Received: by mail-pl1-f179.google.com with SMTP id d5so6033647plo.12
        for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:41 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20210112;
        h=from:to:subject:date:message-id:in-reply-to:references:mime-version
         :content-transfer-encoding;
        bh=XOpaL7AsylBCNXwjwYQdJ2FOVR8xNbSqelIlGWNfswo=;
        b=ops4BW6+d9YSslouNGGDqxs+dGtrHWeQTg6zCyMpCx1snOYkJVsCH65GOjm9fM7+L4
         2RBqJ0gMnTbXp49YAPd7ydYRELUS/tMMLQaWQDQEt+g20yCzDHTXGnz8MCBksNB56jF/
         BkgvSPQo/LdpjJePNgkuASp64KO/nLlcqOdDgA36mOACopa0yC78WMxuFleySwSG5MBg
         DVS1z85mkIhamL1BvWu4HV+IFbEjvGfR1D8Y1WdFOTGAD0q7LHPuL6T/I3liSe9wOdCq
         h1O6ZnlQkg9ks8vLVwxclwh/oKlNBU1va7U3nk07oD+T9VP6Did6ziwlZo4JI88lUieT
         tJWg==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112;
        h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to
         :references:mime-version:content-transfer-encoding;
        bh=XOpaL7AsylBCNXwjwYQdJ2FOVR8xNbSqelIlGWNfswo=;
        b=ABPNmAAXAr29VXrC4jjylCbiDalhA10pjd+RJ8YC6jr6iKTwKPe8Y0aykV6Npz/71E
         wEWbCXbYInK1f06NCu8WDkxfOix03R+ZDeNKGWKPHJ58knEhvKlryhxCXRlqMiG1li7s
         tgLe2brznQyqiDCmiu4HVHDjJK2NmI7LlyO8k+V2icWkNggvzENSIpo1vgtNZ9d02yLR
         fe1nGGvDBs0ppzwcJnL+EM1oexdUi15NF91f27ZYevMXQU8MfLHOecWBH8P1dXZBGzwz
         rRufTUIRnd8KEvkb22e4uNq5eIgrKDtw1gFZPY5LiAq4LSTHzUlmsLJ8G9eBpsqWcDRs
         NaIA==
X-Gm-Message-State: AJIora/fXUdGsmPokreLjfFvPfISs8CvMLLr8G9nyAW7Wvash447DlOE
	l1QV6M33xyrxr6Fj9w6x5YRrEtYaDck=
X-Google-Smtp-Source: 
 AGRyM1sPtiTo7kWNVc711t8Q3FwJ1TDCPF0wPRGBH1D/b8hUWQ0/tH1eSUIGBaccM3JPrW/CNqwXVg==
X-Received: by 2002:a17:90b:3b88:b0:1e6:7aa2:4301 with SMTP id
 pc8-20020a17090b3b8800b001e67aa24301mr26857534pjb.118.1655559880720;
        Sat, 18 Jun 2022 06:44:40 -0700 (PDT)
Received: from keaua.hsd1.ca.comcast.net
 ([2601:202:4180:a5c0:b704:2c1c:4bb5:cab1])
        by smtp.gmail.com with ESMTPSA id
 o26-20020a63921a000000b00408a3724b38sm5689880pgd.76.2022.06.18.06.44.39
        for <yocto@lists.yoctoproject.org>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Sat, 18 Jun 2022 06:44:39 -0700 (PDT)
From: Armin Kuster <akuster808@gmail.com>
To: yocto@lists.yoctoproject.org
Subject: [meta-security][PATCH 3/9] oeqa: update smack runtime test
Date: Sat, 18 Jun 2022 06:44:29 -0700
Message-Id: <20220618134435.2370878-3-akuster808@gmail.com>
X-Mailer: git-send-email 2.25.1
In-Reply-To: <20220618134435.2370878-1-akuster808@gmail.com>
References: <20220618134435.2370878-1-akuster808@gmail.com>
MIME-Version: 1.0
List-Id: <yocto.lists.yoctoproject.org>
X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <yocto@lists.yoctoproject.org>; Sat, 18 Jun 2022 13:44:49 -0000
X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/57345

drop test_smack_mmap_enforced as is was skipped do to possible licensing issues

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 lib/oeqa/runtime/cases/smack.py | 103 +++++---------------------------
 1 file changed, 15 insertions(+), 88 deletions(-)

diff --git a/lib/oeqa/runtime/cases/smack.py b/lib/oeqa/runtime/cases/smack.py
index b8255c7..6b87574 100644
--- a/lib/oeqa/runtime/cases/smack.py
+++ b/lib/oeqa/runtime/cases/smack.py
@@ -15,17 +15,16 @@ class SmackBasicTest(OERuntimeTestCase):
 
     @classmethod
     def setUpClass(cls):
-        cls.smack_path = ""
         cls.current_label  = ""
         cls.uid = 1000
+        status, output = cls.tc.target.run("grep smack /proc/mounts | awk '{print $2}'")
+        cls.smack_path = output
 
     @skipIfNotFeature('smack',
         'Test requires smack to be in DISTRO_FEATURES')
     @OEHasPackage(['smack-test'])
     @OETestDepends(['ssh.SSHTest.test_ssh'])
     def test_smack_basic(self):
-        status, output = self.target.run("grep smack /proc/mounts | awk '{print $2}'")
-        self.smack_path = output
         status,output = self.target.run("cat /proc/self/attr/current")
         self.current_label = output.strip()
 
@@ -41,11 +40,11 @@ class SmackBasicTest(OERuntimeTestCase):
             "Status and output: %d %s" %(status, output))
         status, output = self.target.run("chsmack %s" %filename)
         self.target.run("rm %s" %filename)
-        m = re.search('(?<=access=")\S+(?=")', output)
+        m = re.search('(access=")\S+(?=")', output)
         if m is None:
             self.fail("Did not find access attribute")
         else:
-            label_retrieved = m .group(0)
+            label_retrieved = re.split("access=\"", output)[1][:-1]
             self.assertEqual(
                 LABEL, label_retrieved,
                 "label not set correctly. expected and gotten: "
@@ -64,11 +63,11 @@ class SmackBasicTest(OERuntimeTestCase):
             "Status and output: %d %s" %(status, output))
         status, output = self.target.run("chsmack %s" %filename)
         self.target.run("rm %s" %filename)
-        m= re.search('(?<=execute=")\S+(?=")', output)
+        m= re.search('(execute=")\S+(?=")', output)
         if m is None:
             self.fail("Did not find execute attribute")
         else:
-            label_retrieved = m.group(0)
+            label_retrieved = re.split("execute=\"", output)[1][:-1]
             self.assertEqual(
                 LABEL, label_retrieved,
                 "label not set correctly. expected and gotten: " +
@@ -87,11 +86,11 @@ class SmackBasicTest(OERuntimeTestCase):
             "Status and output: %d %s" %(status, output))
         status, output = self.target.run("chsmack %s" %filename)
         self.target.run("rm %s" %filename)
-        m = re.search('(?<=mmap=")\S+(?=")', output)
+        m = re.search('(mmap=")\S+(?=")', output)
         if m is None:
             self.fail("Did not find mmap attribute")
         else:
-            label_retrieved = m.group(0)
+            label_retrieved = re.split("mmap=\"", output)[1][:-1]
             self.assertEqual(
                 LABEL, label_retrieved,
                 "label not set correctly. expected and gotten: " +
@@ -109,11 +108,11 @@ class SmackBasicTest(OERuntimeTestCase):
                         "Status and output: %d %s" %(status, output))
         status, output = self.target.run("chsmack %s" %directory)
         self.target.run("rmdir %s" %directory)
-        m = re.search('(?<=transmute=")\S+(?=")', output)
+        m = re.search('(transmute=")\S+(?=")', output)
         if m is None:
             self.fail("Did not find transmute attribute")
         else:
-            label_retrieved = m.group(0)
+            label_retrieved = re.split("transmute=\"", output)[1][:-1]
             self.assertEqual(
                 "TRUE", label_retrieved,
                 "label not set correctly. expected and gotten: " +
@@ -127,10 +126,10 @@ class SmackBasicTest(OERuntimeTestCase):
         '''
 
         labelf = "/proc/self/attr/current"
-        command = "/bin/sh -c 'echo PRIVILEGED >%s; cat %s'" %(labelf, labelf)
+        command = "/bin/sh -c 'echo PRIVILEGED >%s'; cat %s" %(labelf, labelf)
 
         status, output = self.target.run(
-            "notroot.py 0 %s %s" %(self.current_label, command))
+            "/usr/sbin/notroot.py 0 %s %s" %(self.current_label, command))
 
         self.assertIn("PRIVILEGED", output,
                     "Privilege process did not change label.Output: %s" %output)
@@ -142,7 +141,7 @@ class SmackBasicTest(OERuntimeTestCase):
 
         command = "/bin/sh -c 'echo %s >/proc/self/attr/current'" %LABEL
         status, output = self.target.run(
-            "notroot.py %d %s %s"
+            "/usr/sbin/notroot.py %d %s %s"
             %(self.uid, self.current_label, command) +
             " 2>&1 | grep 'Operation not permitted'" )
 
@@ -160,9 +159,9 @@ class SmackBasicTest(OERuntimeTestCase):
         filename = "/tmp/test_unprivileged_change_file_label"
 
         self.target.run("touch %s" % filename)
-        self.target.run("notroot.py %d %s" %(self.uid, self.current_label))
+        self.target.run("/usr/sbin/notroot.py %d %s" %(self.uid, self.current_label))
         status, output = self.target.run(
-            "notroot.py " +
+            "/usr/sbin/notroot.py " +
             "%d unprivileged %s -a %s %s 2>&1 " %(self.uid, chsmack, LABEL, filename) +
             "| grep 'Operation not permitted'"  )
 
@@ -346,78 +345,6 @@ class SmackBasicTest(OERuntimeTestCase):
         self.assertEqual(status, 0, output)
 
 
-    @OETestDepends(['smack.SmackBasicTest.test_smack_basic'])
-    def test_smack_mmap_enforced(self):
-        '''Test if smack mmap access is enforced'''
-        raise unittest.SkipTest("Depends on mmap_test, which was removed from the layer while investigating its license.")
-
-        #      12345678901234567890123456789012345678901234567890123456
-        delr1="mmap_label              mmap_test_label1        -----"
-        delr2="mmap_label              mmap_test_label2        -----"
-        delr3="mmap_file_label         mmap_test_label1        -----"
-        delr4="mmap_file_label         mmap_test_label2        -----"
-
-        RuleA="mmap_label              mmap_test_label1        rw---"
-        RuleB="mmap_label              mmap_test_label2        r--at"
-        RuleC="mmap_file_label         mmap_test_label1        rw---"
-        RuleD="mmap_file_label         mmap_test_label2        rwxat"
-
-        mmap_label="mmap_label"
-        file_label="mmap_file_label"
-        test_file = "/usr/sbin/smack_test_mmap"
-        mmap_exe = "/tmp/mmap_test"
-        status, echo = self.target.run("which echo")
-        status, output = self.target.run(
-            "notroot.py %d %s %s 'test' > %s" \
-            %(self.uid, self.current_label, echo, test_file))
-        status, output = self.target.run("ls %s" %test_file)
-        self.assertEqual(status, 0, "Could not create mmap test file")
-        self.target.run("chsmack -m %s %s" %(file_label, test_file))
-        self.target.run("chsmack -e %s %s" %(mmap_label, mmap_exe))
-
-        # test with no rules with mmap label or exec label as subject
-        # access should be granted
-        self.target.run('echo -n "%s" > %s/load' %(delr1, self.smack_path))
-        self.target.run('echo -n "%s" > %s/load' %(delr2, self.smack_path))
-        self.target.run('echo -n "%s" > %s/load' %(delr3, self.smack_path))
-        self.target.run('echo -n "%s" > %s/load' %(delr4, self.smack_path))
-        status, output = self.target.run("%s %s 0 2" % (mmap_exe, test_file))
-        self.assertEqual(
-            status, 0,
-            "Should have mmap access without rules. Output: %s" %output)
-
-        # add rules that do not match access required
-        self.target.run('echo -n "%s" > %s/load' %(RuleA, self.smack_path))
-        self.target.run('echo -n "%s" > %s/load' %(RuleB, self.smack_path))
-        status, output = self.target.run("%s %s 0 2" % (mmap_exe, test_file))
-        self.assertNotEqual(
-            status, 0,
-            "Should not have mmap access with unmatching rules. " +
-            "Output: %s" %output)
-        self.assertIn(
-            "Permission denied", output,
-            "Mmap access should be denied with unmatching rules")
-
-        # add rule to match only partially (one way)
-        self.target.run('echo -n "%s" > %s/load' %(RuleC, self.smack_path))
-        status, output = self.target.run("%s %s 0 2" %(mmap_exe, test_file))
-        self.assertNotEqual(
-            status, 0,
-            "Should not have mmap access with partial matching rules. " +
-            "Output: %s" %output)
-        self.assertIn(
-            "Permission denied", output,
-            "Mmap access should be denied with partial matching rules")
-
-        # add rule to match fully
-        self.target.run('echo -n "%s" > %s/load' %(RuleD, self.smack_path))
-        status, output = self.target.run("%s %s 0 2" %(mmap_exe, test_file))
-        self.assertEqual(
-            status, 0,
-            "Should have mmap access with full matching rules." +
-            "Output: %s" %output)
-
-
     @OETestDepends(['smack.SmackBasicTest.test_smack_basic'])
     def test_smack_transmute_dir(self):
         '''Test if smack transmute attribute works

From patchwork Sat Jun 18 13:44:30 2022
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: akuster808 <akuster808@gmail.com>
X-Patchwork-Id: 9312
X-Patchwork-Delegate: akuster808@gmail.com
Return-Path: <akuster808@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org
 (localhost.localdomain [127.0.0.1])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 49A8CC433EF
	for <webhook@archiver.kernel.org>; Sat, 18 Jun 2022 13:44:49 +0000 (UTC)
Received: from mail-pj1-f51.google.com (mail-pj1-f51.google.com
 [209.85.216.51])
 by mx.groups.io with SMTP id smtpd.web11.9243.1655559882864997908
 for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:43 -0700
Authentication-Results: mx.groups.io;
 dkim=pass header.i=@gmail.com header.s=20210112 header.b=B6vPNlpi;
 spf=pass (domain: gmail.com, ip: 209.85.216.51,
 mailfrom: akuster808@gmail.com)
Received: by mail-pj1-f51.google.com with SMTP id
 y13-20020a17090a154d00b001eaaa3b9b8dso6431674pja.2
        for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20210112;
        h=from:to:subject:date:message-id:in-reply-to:references:mime-version
         :content-transfer-encoding;
        bh=Iqbs2Ek9fcjAj4Ff5m1DnXrIlRWSsoeKt6kXFO9vSFo=;
        b=B6vPNlpinX8CYaAQFePMulNrWc2GTz8LapNnx/9cs9PSzRzIrzIfADXnxZWgQBETvm
         /M8nd9RiW/Ui/YQ2DGIcg+NHTV2ZfFBxBEnSdtr6vSIyhFVTOIJapX1msDnKJB8ReqP+
         qaOWi8wBMYho3Xj//ZoJ+0VeYmFx3ngFsk5zrc6DBh05L6X1yl/6TbAn9arhynzoO1pr
         xnuBzFVKj6JsTcmq3KEhjl4tD8xLTXHaaqFvOCB43rIK13oYgp7viZf0vbizDrczuKOl
         cdUAAhV4UVX5rpNTS086uUWx4ZZw5QBFwAY8KgGW2D7cwlIS9xADiv6gIXA5wgYxVABg
         8M1A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112;
        h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to
         :references:mime-version:content-transfer-encoding;
        bh=Iqbs2Ek9fcjAj4Ff5m1DnXrIlRWSsoeKt6kXFO9vSFo=;
        b=hwmpVoeoJx1LGHTWt1JpronG6cLLEU0sKwOZJte0oNuZaFf4cTHTiVVR+0TWJVluqf
         Tcxj1v6iIo9slVIuxhL6Nz/qK3/S6DFewQX31JJasyz3NsZYT+IQy/p6z7D3wqm/YK7f
         sIyQRg6C/RM4tVQ109VOd8rDrA9rcjsMolMpdZPJQTVJxMhc8Sdm9dmZx0Ep1gcUCWL4
         9mp9USbuCwCpfYrNcZdyV/icy20wtgVMqYwhj03+3nP5G5+i5oMqIqOkMuWBEKBZx6ZW
         oMRHKixazJnZ//9N7B1fgVl3E8J5qvKMDR+iY5695YNtyOF+e+ZxxIxbSknsr3S8jZQ1
         MPaA==
X-Gm-Message-State: AJIora+bEoH5Hk4T1EpmB7oSlrmXmcVUDfyjHvzhWsQRvLR7Ypy/vogf
	2iCObj7ctnGd8lFoka0AIoIhfUKoTZI=
X-Google-Smtp-Source: 
 AGRyM1u+1j4tqrC2aIYALv1zX/OqfjM/M7pQNVWxaQHdKsDzRL22yi8rp1cZKcrk7JcG//pcWI1kGA==
X-Received: by 2002:a17:902:eccf:b0:168:faa0:4eed with SMTP id
 a15-20020a170902eccf00b00168faa04eedmr14574919plh.139.1655559882018;
        Sat, 18 Jun 2022 06:44:42 -0700 (PDT)
Received: from keaua.hsd1.ca.comcast.net
 ([2601:202:4180:a5c0:b704:2c1c:4bb5:cab1])
        by smtp.gmail.com with ESMTPSA id
 o26-20020a63921a000000b00408a3724b38sm5689880pgd.76.2022.06.18.06.44.40
        for <yocto@lists.yoctoproject.org>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Sat, 18 Jun 2022 06:44:41 -0700 (PDT)
From: Armin Kuster <akuster808@gmail.com>
To: yocto@lists.yoctoproject.org
Subject: [meta-security][PATCH 4/9] aide: add a few more config options
Date: Sat, 18 Jun 2022 06:44:30 -0700
Message-Id: <20220618134435.2370878-4-akuster808@gmail.com>
X-Mailer: git-send-email 2.25.1
In-Reply-To: <20220618134435.2370878-1-akuster808@gmail.com>
References: <20220618134435.2370878-1-akuster808@gmail.com>
MIME-Version: 1.0
List-Id: <yocto.lists.yoctoproject.org>
X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <yocto@lists.yoctoproject.org>; Sat, 18 Jun 2022 13:44:49 -0000
X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/57346

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 recipes-ids/aide/aide_0.17.4.bb | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/recipes-ids/aide/aide_0.17.4.bb b/recipes-ids/aide/aide_0.17.4.bb
index ebd6ac3..87b690d 100644
--- a/recipes-ids/aide/aide_0.17.4.bb
+++ b/recipes-ids/aide/aide_0.17.4.bb
@@ -12,7 +12,7 @@ SRC_URI[sha256sum] = "c81505246f3ffc2e76036d43a77212ae82895b5881d9b9e25c1361b1a9
 
 inherit autotools pkgconfig
 
-PACKAGECONFIG ??=" mhash zlib e2fsattrs \
+PACKAGECONFIG ??=" mhash zlib e2fsattrs posix capabilities curl \
                  ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux audit', '', d)} \
                  ${@bb.utils.contains('DISTRO_FEATURES', 'xattr', 'xattr', '', d)} \
                  "
@@ -24,6 +24,8 @@ PACKAGECONFIG[audit] = "--with-audit, --without-audit,audit"
 PACKAGECONFIG[gcrypt] = "--with-gcrypt, --without-gcrypt, libgcrypt, libgcrypt"
 PACKAGECONFIG[mhash] = "--with-mhash, --without-mhash, libmhash, libmhash"
 PACKAGECONFIG[e2fsattrs] = "--with-e2fsattrs, --without-e2fsattrs, e2fsprogs, e2fsprogs"
+PACKAGECONFIG[capabilities] = "--with-capabilities, --without-capabilities, libcap, libcap"
+PACKAGECONFIG[posix] = "--with-posix-acl, --without-posix-acl, acl, acl"
 
 do_install:append () {
     install -d ${D}${libdir}/${PN}/logs   

From patchwork Sat Jun 18 13:44:31 2022
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: akuster808 <akuster808@gmail.com>
X-Patchwork-Id: 9315
X-Patchwork-Delegate: akuster808@gmail.com
Return-Path: <akuster808@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org
 (localhost.localdomain [127.0.0.1])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 4AFD8C43334
	for <webhook@archiver.kernel.org>; Sat, 18 Jun 2022 13:44:49 +0000 (UTC)
Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com
 [209.85.215.170])
 by mx.groups.io with SMTP id smtpd.web11.9244.1655559884983115860
 for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:45 -0700
Authentication-Results: mx.groups.io;
 dkim=pass header.i=@gmail.com header.s=20210112 header.b=Xf9LQ0d8;
 spf=pass (domain: gmail.com, ip: 209.85.215.170,
 mailfrom: akuster808@gmail.com)
Received: by mail-pg1-f170.google.com with SMTP id 184so6333290pga.12
        for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:44 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20210112;
        h=from:to:subject:date:message-id:in-reply-to:references:mime-version
         :content-transfer-encoding;
        bh=Vl8szZlL2MUy2kmcCrLn69Qb7nqFPWOZjTzg90WdklY=;
        b=Xf9LQ0d8Y9bJyuKx0Y3Y9xkKYY7zlAvOrr6PUcX2wpX/UHMqvH2CU7fnPCZXp5i6d5
         J2eEPHmFYHiBnpkbsgrxYrNTlzn6jbtW2RtZQmHhUjfEhzWxYLIOr9317s+rBZMb0Gvi
         oGGablc79l67x7+LhyGgZAPM/PmTK/HTq78+eGuI/s7e0qwvCunIzT3ePLBJSdWWqkT4
         62cb9hdpCk6flgde0a2eIxCwrMn73ij2QYZBfX5x5xHGFg5n2/EeKbCcvgXMUThN0LnR
         BwP6jlYD7SwrXH3VvopNyEkaJpHgluOMOA9My/VVY7LImzcwEBzqGQQb6bNbPyr2DlsC
         JG2A==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112;
        h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to
         :references:mime-version:content-transfer-encoding;
        bh=Vl8szZlL2MUy2kmcCrLn69Qb7nqFPWOZjTzg90WdklY=;
        b=NMSE+D8o4D8fn+YoqOM3Bwcrj1tMbezKti7vfTFVn4oYtg+RWdldufUQxSILF4BJd7
         8o/57ruacfbTGYVMu2YfX4H2I5l/7/ZBs/GrZ7+eKApnECBWBlqxZCEG4qsBmHaqXdiP
         29s4ikLKYxTodgIIkXOZ4BVCzHvQY9YNzQ7weBABI+sWmMaSilK5v40SNwcml9r0a19B
         wy3WkE/zJKxvYD7DXVTv625nb6hq3djAPntxLs/05pbVqGrkYt0Yk6hXwFPtscahv+8r
         AQj0wM62hKLsojNDdn4PD6J8+9GoKFImzRA4keI4HxbJT4aPJrd5FEPRkxvNIJzv11Jr
         0iwQ==
X-Gm-Message-State: AJIora/jYj0VoCEvgfYDQp99/HLQ/9ivtcMxQUV7g7t69eRxNYsLwCt7
	+MX7P0N0uEXAfReEW73vUgF1445rTrU=
X-Google-Smtp-Source: 
 AGRyM1uwWK8lXlvR+PUsPXZq+iDLqJTT4wSnlej9+UEBpJNRsOnZucBiMAAoLXSkYW0Op3qq0GeDcg==
X-Received: by 2002:a63:7909:0:b0:40c:6cba:b1d0 with SMTP id
 u9-20020a637909000000b0040c6cbab1d0mr4196948pgc.353.1655559884115;
        Sat, 18 Jun 2022 06:44:44 -0700 (PDT)
Received: from keaua.hsd1.ca.comcast.net
 ([2601:202:4180:a5c0:b704:2c1c:4bb5:cab1])
        by smtp.gmail.com with ESMTPSA id
 o26-20020a63921a000000b00408a3724b38sm5689880pgd.76.2022.06.18.06.44.42
        for <yocto@lists.yoctoproject.org>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Sat, 18 Jun 2022 06:44:42 -0700 (PDT)
From: Armin Kuster <akuster808@gmail.com>
To: yocto@lists.yoctoproject.org
Subject: [meta-security][PATCH 5/9] oeqa: add aide test
Date: Sat, 18 Jun 2022 06:44:31 -0700
Message-Id: <20220618134435.2370878-5-akuster808@gmail.com>
X-Mailer: git-send-email 2.25.1
In-Reply-To: <20220618134435.2370878-1-akuster808@gmail.com>
References: <20220618134435.2370878-1-akuster808@gmail.com>
MIME-Version: 1.0
List-Id: <yocto.lists.yoctoproject.org>
X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <yocto@lists.yoctoproject.org>; Sat, 18 Jun 2022 13:44:49 -0000
X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/57347

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 lib/oeqa/runtime/cases/aide.py | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 lib/oeqa/runtime/cases/aide.py

diff --git a/lib/oeqa/runtime/cases/aide.py b/lib/oeqa/runtime/cases/aide.py
new file mode 100644
index 0000000..4c7633c
--- /dev/null
+++ b/lib/oeqa/runtime/cases/aide.py
@@ -0,0 +1,26 @@
+# Copyright (C) 2022 Armin Kuster <akuster808@gmail.com>
+#
+import re
+
+from oeqa.runtime.case import OERuntimeTestCase
+from oeqa.core.decorator.depends import OETestDepends
+from oeqa.runtime.decorator.package import OEHasPackage
+
+
+class AideTest(OERuntimeTestCase):
+
+    @OEHasPackage(['aide'])
+    @OETestDepends(['ssh.SSHTest.test_ssh'])
+    def test_aide_help(self):
+        status, output = self.target.run('aide --help')
+        msg = ('Aide help command does not work as expected. '
+               'Status and output:%s and %s' % (status, output))
+        self.assertEqual(status, 0, msg = msg)
+
+    @OETestDepends(['aide.AideTest.test_aide_help'])
+    def test_aide_dbinit(self):
+        status, output = self.target.run('aide --init')
+        match = re.search('Number of entries:', output)
+        if not match:
+            msg = ('Aide db init failed: output is:\n%s' % output)
+            self.assertEqual(status, 0, msg = msg)

From patchwork Sat Jun 18 13:44:32 2022
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: akuster808 <akuster808@gmail.com>
X-Patchwork-Id: 9314
X-Patchwork-Delegate: akuster808@gmail.com
Return-Path: <akuster808@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org
 (localhost.localdomain [127.0.0.1])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 55FC7CCA480
	for <webhook@archiver.kernel.org>; Sat, 18 Jun 2022 13:44:49 +0000 (UTC)
Received: from mail-pg1-f170.google.com (mail-pg1-f170.google.com
 [209.85.215.170])
 by mx.groups.io with SMTP id smtpd.web11.9244.1655559884983115860
 for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:47 -0700
Authentication-Results: mx.groups.io;
 dkim=pass header.i=@gmail.com header.s=20210112 header.b=LmI1cUWR;
 spf=pass (domain: gmail.com, ip: 209.85.215.170,
 mailfrom: akuster808@gmail.com)
Received: by mail-pg1-f170.google.com with SMTP id 184so6333290pga.12
        for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:47 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20210112;
        h=from:to:subject:date:message-id:in-reply-to:references:mime-version
         :content-transfer-encoding;
        bh=eIaElLP1d4Za6qKp6SSqexDwEKFW5XOMu9kTJtcuwF8=;
        b=LmI1cUWR9eErFN6jI1hs3KDgk0Z362DbkifuP9isOyTvOVPDUWmfmf3Mcnteg6IWeM
         +9qRFAjnM+teOPJV/5a+hbYREjiWUYClxMrnOjuI6FS3kX3fbSvXXJ6J5cqQLVWNSSFU
         ygTG+8L3vdWB6CULZCSNsd+X5i0up5gACYv7acjdirbSS/oQFXDZuiFK7V2dfK0AEuI7
         WB1U49sIK5CLc5FjOorkKzNTNx0r8cJB5kp0JQVxTPH5MNAHIqErarK682d2CzX2eokS
         6H3Ro83m2i8WodG+ieezIgn+0plVcUsMyghdJXr/xDcO647+03HTK3h3P8VYNXjJmxFb
         0rkA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112;
        h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to
         :references:mime-version:content-transfer-encoding;
        bh=eIaElLP1d4Za6qKp6SSqexDwEKFW5XOMu9kTJtcuwF8=;
        b=eeGAnEK5LpGpg7tRuaCNXw6YGpLvGiGSiNj4fA61Iz2F74p7fYY4K2oTejwhGs8yrK
         3ERY7ri12Wk7kYYCS1yqFdGvP5VB0/jLWNoScNf4ESsV0aTyvG9YilvVKkQjf7NvsPwM
         SArI6IgiPsvEnLXpb8njNLjIVTLQZuWA+Y/1BQTK8JiR/PJHimkSsdHU0y1CxTy8+9GI
         3fk8MfWqvZcrRCGejxI9lC0p6iq3699PIlq6i7MvIqRHi+nZuzMQKikuqybYNXvUcVWr
         D9CrwUkJtNe7hlieiFZ8zHXXcbU6UT3Ssl0sbO8QEPisvhi3NpkPwCw42OP/S2KHfvNJ
         In+A==
X-Gm-Message-State: AJIora8vtfWpoUgDF9muoPopa89SKYJBlEPrm0RZAwzUV9YiVLniTl0s
	1yKJh0yQNqAvMwOuZMuZalBDvkkyZuw=
X-Google-Smtp-Source: 
 AGRyM1u0QPs3TiW2QUGiV9q93SUoaO+yUHRbPlq05uKUdHJgc1H25cYEkNJzgBK0tyJJDRXEoeHsXg==
X-Received: by 2002:a63:4e21:0:b0:406:fb5b:a3 with SMTP id
 c33-20020a634e21000000b00406fb5b00a3mr13542191pgb.195.1655559886470;
        Sat, 18 Jun 2022 06:44:46 -0700 (PDT)
Received: from keaua.hsd1.ca.comcast.net
 ([2601:202:4180:a5c0:b704:2c1c:4bb5:cab1])
        by smtp.gmail.com with ESMTPSA id
 o26-20020a63921a000000b00408a3724b38sm5689880pgd.76.2022.06.18.06.44.44
        for <yocto@lists.yoctoproject.org>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Sat, 18 Jun 2022 06:44:45 -0700 (PDT)
From: Armin Kuster <akuster808@gmail.com>
To: yocto@lists.yoctoproject.org
Subject: [meta-security][PATCH 6/9] libmhash: add native pkg support
Date: Sat, 18 Jun 2022 06:44:32 -0700
Message-Id: <20220618134435.2370878-6-akuster808@gmail.com>
X-Mailer: git-send-email 2.25.1
In-Reply-To: <20220618134435.2370878-1-akuster808@gmail.com>
References: <20220618134435.2370878-1-akuster808@gmail.com>
MIME-Version: 1.0
List-Id: <yocto.lists.yoctoproject.org>
X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <yocto@lists.yoctoproject.org>; Sat, 18 Jun 2022 13:44:49 -0000
X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/57348

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 recipes-security/libmhash/libmhash_0.9.9.9.bb | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/recipes-security/libmhash/libmhash_0.9.9.9.bb b/recipes-security/libmhash/libmhash_0.9.9.9.bb
index 35c5ff8..4d1f584 100644
--- a/recipes-security/libmhash/libmhash_0.9.9.9.bb
+++ b/recipes-security/libmhash/libmhash_0.9.9.9.bb
@@ -35,3 +35,5 @@ do_compile_ptest() {
 do_install_ptest() {
     install -m 0755 ${S}/demo/mhash ${D}${PTEST_PATH}
 }
+
+BBCLASSEXTEND = "native"

From patchwork Sat Jun 18 13:44:33 2022
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: akuster808 <akuster808@gmail.com>
X-Patchwork-Id: 9318
X-Patchwork-Delegate: akuster808@gmail.com
Return-Path: <akuster808@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org
 (localhost.localdomain [127.0.0.1])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 26F88C433EF
	for <webhook@archiver.kernel.org>; Sat, 18 Jun 2022 13:44:59 +0000 (UTC)
Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com
 [209.85.216.50])
 by mx.groups.io with SMTP id smtpd.web12.9361.1655559890305976449
 for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:50 -0700
Authentication-Results: mx.groups.io;
 dkim=pass header.i=@gmail.com header.s=20210112 header.b=ng6IXbcz;
 spf=pass (domain: gmail.com, ip: 209.85.216.50,
 mailfrom: akuster808@gmail.com)
Received: by mail-pj1-f50.google.com with SMTP id
 p3-20020a17090a428300b001ec865eb4a2so1754541pjg.3
        for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:50 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20210112;
        h=from:to:subject:date:message-id:in-reply-to:references:mime-version
         :content-transfer-encoding;
        bh=Vt+cwExbDiLNMVz6dvghKt+UIm7DrLpIPSanUXGde6w=;
        b=ng6IXbczWkmNUnukncvP+SgUbdKw8wOU42NRabuDCk5xgkGOvTudbX0yT37/C9a6LV
         ocIawSCBKfQ7z5Y1i8+Z+pjTSc+dLwBwMyC4INTEUazsBXdeqMY0J6XqYooAApPfobaq
         iSzx/Lm1aI1l4/94nHdpulgW+qz5ewFBJbzikvl3X7i6Q71EKdmuiekGkdWqvhsBMkDI
         ybkQBMDq6aEYszTXpFIzz/XBx/DHj9d7W1RbN+Pu9GOhMKJbWXwGc8xxK3UtQPSs+dg7
         diaeVvoQPayZhIUVsDnkibFuAg/gngBoNimTHRN1CAM5eUN4wrYKW0E40up47hOE+LMX
         NItA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112;
        h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to
         :references:mime-version:content-transfer-encoding;
        bh=Vt+cwExbDiLNMVz6dvghKt+UIm7DrLpIPSanUXGde6w=;
        b=HJE9DXti2s/GarK2kwPXP/Pjd7gB++xAuCE+r+ebaz0WcFadGJwBUlHG+xw3WmdhEO
         DB8C35LPUnVKRYwvDxuZwmQItn4kQcGL0ORCqsLmLAiRfRr1O+VdTjzFKGZAddBRbNHb
         3Hf0EDkfLGN5I5LzBsaUS0/SZlZtOqNhgRMp0eatKyUEjAm781CFZ9rvbHHegtIm5Pur
         Aivrls5NlqZCS1SShdGo3aFE0shV6viYTEwN6DoqOXkigtXmP/fKdzf15PIhNyOdjzbd
         bCooVl2tXU1aODGGubLbRgLYGgBPnvy8B7v164j7bGgFC+kMDEtkdHsGYB/GtWXU++LA
         o3cg==
X-Gm-Message-State: AJIora9gNWVbrJ8SKT5Un9L0kbKknxEejkJss6BGp0Dfo60ii6kOlRyv
	c6mdrTraN0VDKmKHAUxnAMohrJvr1ao=
X-Google-Smtp-Source: 
 AGRyM1svQm3zRw0F7Bn8r6zkp2OpqnWDfLO808jbQt0UlWV+j6i8NlpiZYZL8uRs9AuhanmJwb0BrQ==
X-Received: by 2002:a17:903:245:b0:168:efbc:c10 with SMTP id
 j5-20020a170903024500b00168efbc0c10mr14537058plh.71.1655559889417;
        Sat, 18 Jun 2022 06:44:49 -0700 (PDT)
Received: from keaua.hsd1.ca.comcast.net
 ([2601:202:4180:a5c0:b704:2c1c:4bb5:cab1])
        by smtp.gmail.com with ESMTPSA id
 o26-20020a63921a000000b00408a3724b38sm5689880pgd.76.2022.06.18.06.44.46
        for <yocto@lists.yoctoproject.org>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Sat, 18 Jun 2022 06:44:48 -0700 (PDT)
From: Armin Kuster <akuster808@gmail.com>
To: yocto@lists.yoctoproject.org
Subject: [meta-security][PATCH 7/9] classes: add aide routines
Date: Sat, 18 Jun 2022 06:44:33 -0700
Message-Id: <20220618134435.2370878-7-akuster808@gmail.com>
X-Mailer: git-send-email 2.25.1
In-Reply-To: <20220618134435.2370878-1-akuster808@gmail.com>
References: <20220618134435.2370878-1-akuster808@gmail.com>
MIME-Version: 1.0
List-Id: <yocto.lists.yoctoproject.org>
X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <yocto@lists.yoctoproject.org>; Sat, 18 Jun 2022 13:44:59 -0000
X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/57349

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 classes/aide-base.bbclass    | 11 ++++++++
 classes/aide-db-init.bbclass | 52 ++++++++++++++++++++++++++++++++++++
 2 files changed, 63 insertions(+)
 create mode 100644 classes/aide-base.bbclass
 create mode 100644 classes/aide-db-init.bbclass

diff --git a/classes/aide-base.bbclass b/classes/aide-base.bbclass
new file mode 100644
index 0000000..36cc454
--- /dev/null
+++ b/classes/aide-base.bbclass
@@ -0,0 +1,11 @@
+#
+# Copyright 2022 Armin Kuster <akuster808@gmail.com>
+#
+
+STAGING_AIDE_DIR ?= "${TMPDIR}/work-shared/${MACHINE}/aida"
+AIDE_INCLUDE_DIRS ?= "/lib"
+AIDE_SKIP_DIRS ?= "/lib/modules/.\*"
+
+AIDE_SCAN_POSTINIT ?= "0"
+AIDE_RESCAN_POSTINIT ?= "0"
+
diff --git a/classes/aide-db-init.bbclass b/classes/aide-db-init.bbclass
new file mode 100644
index 0000000..800006f
--- /dev/null
+++ b/classes/aide-db-init.bbclass
@@ -0,0 +1,52 @@
+#
+# Copyright 2022 Armin Kuster <akuster808@gmail.com>
+#
+# This class creates the initial aide database durning
+# the build cycle allowing for that set being skipped during boot
+# It has an additional benefit of having not being tamper with
+# after build.
+#
+# To have the aide db created during build
+# 1. Extend local.conf:
+#    INHERIT += "adie-init-db"
+#
+# These are the defaults as defined in aide-base.bbclass
+# They can be overriden in your local.conf or other distro include 
+#
+# To define where the share directory should be.
+#    STAGING_AIDE_DIR = "${TMPDIR}/work-shared/${MACHINE}/aida"
+#
+# To define which directories should be inclued in a scan
+#    AIDE_INCLUDE_DIRS ?= "/lib"
+#
+# To exclude directories and files from being scanned
+#    AIDE_SKIP_DIRS ?= "/lib/modules/.\*"
+#
+# To controll if a db init should happen at postint 
+#    AIDE_SCAN_POSTINIT ?= "0"
+#
+# To cotroll if a db recan should be run at postinit
+#    AIDE_RESCAN_POSTINIT ?= "0"
+
+inherit aide-base 
+
+aide_init_db() {
+    for dir in ${AIDE_INCLUDE_DIRS}; do
+        echo "${IMAGE_ROOTFS}${dir} NORMAL" >> ${STAGING_AIDE_DIR}/aide.conf
+    done
+    for dir in ${AIDE_SKIP_DIRS}; do
+        echo "!${IMAGE_ROOTFS}${dir}" >> ${STAGING_AIDE_DIR}/aide.conf
+    done
+
+
+    ${STAGING_AIDE_DIR}/bin/aide -c ${STAGING_AIDE_DIR}/aide.conf --init
+    gunzip ${STAGING_AIDE_DIR}/lib/aide.db.gz 
+    # strip out native path
+    sed -i -e 's:${IMAGE_ROOTFS}::' ${STAGING_AIDE_DIR}/lib/aide.db
+    gzip -9 ${STAGING_AIDE_DIR}/lib/aide.db 
+    cp -f ${STAGING_AIDE_DIR}/lib/aide.db.gz ${IMAGE_ROOTFS}${libdir}/aide
+}
+
+EXTRA_IMAGEDEPENDS:append = " aide-native"
+
+ROOTFS_POSTPROCESS_COMMAND:append = " aide_init_db;"

From patchwork Sat Jun 18 13:44:34 2022
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: akuster808 <akuster808@gmail.com>
X-Patchwork-Id: 9319
X-Patchwork-Delegate: akuster808@gmail.com
Return-Path: <akuster808@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org
 (localhost.localdomain [127.0.0.1])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 236CCC43334
	for <webhook@archiver.kernel.org>; Sat, 18 Jun 2022 13:44:59 +0000 (UTC)
Received: from mail-pf1-f171.google.com (mail-pf1-f171.google.com
 [209.85.210.171])
 by mx.groups.io with SMTP id smtpd.web08.9335.1655559892822501760
 for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:52 -0700
Authentication-Results: mx.groups.io;
 dkim=pass header.i=@gmail.com header.s=20210112 header.b=UFRotr1i;
 spf=pass (domain: gmail.com, ip: 209.85.210.171,
 mailfrom: akuster808@gmail.com)
Received: by mail-pf1-f171.google.com with SMTP id k127so1234924pfd.10
        for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20210112;
        h=from:to:subject:date:message-id:in-reply-to:references:mime-version
         :content-transfer-encoding;
        bh=lAURO6izP7sThKfR+n0KeH3sl6rCCfauhlzMoFHYbOY=;
        b=UFRotr1iGSMXbcJFoKRk7VXUdGUVkew/i3tNGd7zCxLQ9uKMyST0VVBzS46rRjTUsa
         6zTJWpF8d0ktJYJ/EM96KfBAVhJh/2ASEy1v1sD+U5//r0YpX7gsRXZ45pFVi+lFbl+y
         T14mmyCnw9AL2IsOoSXN2rEC2qbus8w2UGqpqfRKUAeHSDHWdNKj/+GrkjT6FjWTfG/O
         51pwQawFBrEpbNXvIfagiw0HRKlO8H8rg2GBhyR1VoPtUBeVCT4nFNqEr14qZpV63qHe
         dDOmEGNSFP5a1MRdZDoQjuADevURCz4J8OIxSIGBErb1b+roXvq63Exq988uJDYT+Bjb
         Aysw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112;
        h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to
         :references:mime-version:content-transfer-encoding;
        bh=lAURO6izP7sThKfR+n0KeH3sl6rCCfauhlzMoFHYbOY=;
        b=eP3uNldw5ev0V94ZoLaWpL8usZoWgrMU3jyPPvYJtuVodk3xNWVj1/U5ZR2I9q0uAH
         jZi+/3PbafD4YsB5PX6/IyjbqYaTTu4eUSAhg+N7b/vjhxacZmsA85VKZk1Z+A6GvC2F
         i1xSEe5Z3GGyGSnthKA9pB516e2XBzzstOnSlZY1kyQ0x75Ah4Z2T/q0bCSNoQFhTKNO
         RTVkv+VQqiCmDNhNACCD+w/pjmBxZ7TGH6kbINN8C3gtPGLeluosUVMUGGa3SpzszDGr
         mdfVBOb/Aozg/tbxDC07v8pF5cHW/D6oQOigOzYbHmFi5qTofFpXzcyZExKR6bGocsts
         IbPw==
X-Gm-Message-State: AJIora+4Zccpvnmqs/j7BD6Zo1qw49tiITzLE5snI2CEgIqp4jQJqbHU
	N4MbFlM2KSQkJIZJ6DS2GJoL9aKP05A=
X-Google-Smtp-Source: 
 AGRyM1sJoqgIRFkvsvo40wWVPazyS2BObHzLAR9swQHGVj/z+QodRZp0iWf+TGtoKDM+S0yIrPgNoA==
X-Received: by 2002:a63:ff19:0:b0:403:7c60:ae96 with SMTP id
 k25-20020a63ff19000000b004037c60ae96mr13160133pgi.466.1655559891922;
        Sat, 18 Jun 2022 06:44:51 -0700 (PDT)
Received: from keaua.hsd1.ca.comcast.net
 ([2601:202:4180:a5c0:b704:2c1c:4bb5:cab1])
        by smtp.gmail.com with ESMTPSA id
 o26-20020a63921a000000b00408a3724b38sm5689880pgd.76.2022.06.18.06.44.49
        for <yocto@lists.yoctoproject.org>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Sat, 18 Jun 2022 06:44:50 -0700 (PDT)
From: Armin Kuster <akuster808@gmail.com>
To: yocto@lists.yoctoproject.org
Subject: [meta-security][PATCH 8/9] aide: add native support for build time db
 creation
Date: Sat, 18 Jun 2022 06:44:34 -0700
Message-Id: <20220618134435.2370878-8-akuster808@gmail.com>
X-Mailer: git-send-email 2.25.1
In-Reply-To: <20220618134435.2370878-1-akuster808@gmail.com>
References: <20220618134435.2370878-1-akuster808@gmail.com>
MIME-Version: 1.0
List-Id: <yocto.lists.yoctoproject.org>
X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <yocto@lists.yoctoproject.org>; Sat, 18 Jun 2022 13:44:59 -0000
X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/57350

This will help create a aide db during build that is
then installed on the rootfs for verification at boot time.

This work was inspired by:
Marco Cavallini
Yocto Project Ambassador

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 recipes-ids/aide/aide_0.17.4.bb | 32 ++++++++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/recipes-ids/aide/aide_0.17.4.bb b/recipes-ids/aide/aide_0.17.4.bb
index 87b690d..7ce0729 100644
--- a/recipes-ids/aide/aide_0.17.4.bb
+++ b/recipes-ids/aide/aide_0.17.4.bb
@@ -10,7 +10,7 @@ SRC_URI = "https://github.com/aide/aide/releases/download/v${PV}/${BPN}-${PV}.ta
 
 SRC_URI[sha256sum] = "c81505246f3ffc2e76036d43a77212ae82895b5881d9b9e25c1361b1a9b7a846"
 
-inherit autotools pkgconfig
+inherit autotools pkgconfig aide-base
 
 PACKAGECONFIG ??=" mhash zlib e2fsattrs posix capabilities curl \
                  ${@bb.utils.contains('DISTRO_FEATURES', 'selinux', 'selinux audit', '', d)} \
@@ -27,10 +27,31 @@ PACKAGECONFIG[e2fsattrs] = "--with-e2fsattrs, --without-e2fsattrs, e2fsprogs, e2
 PACKAGECONFIG[capabilities] = "--with-capabilities, --without-capabilities, libcap, libcap"
 PACKAGECONFIG[posix] = "--with-posix-acl, --without-posix-acl, acl, acl"
 
+
+do_install[nostamp] = "1"
+
 do_install:append () {
     install -d ${D}${libdir}/${PN}/logs   
     install -d ${D}${sysconfdir}   
     install ${WORKDIR}/aide.conf ${D}${sysconfdir}/
+
+    for dir in ${AIDE_INCLUDE_DIRS}; do
+        echo "${dir} NORMAL" >> ${D}${sysconfdir}/aide.conf
+    done
+    for dir in ${AIDE_SKIP_DIRS}; do
+        echo "!${dir}" >> ${D}${sysconfdir}/aide.conf
+    done
+}
+
+do_install:class-native () {
+    install -d ${STAGING_AIDE_DIR}/bin
+    install -d ${STAGING_AIDE_DIR}/lib/logs
+
+    install ${B}/aide ${STAGING_AIDE_DIR}/bin
+    install ${WORKDIR}/aide.conf ${STAGING_AIDE_DIR}/
+
+    sed -i -s "s:\@\@define DBDIR.*:\@\@define DBDIR ${STAGING_AIDE_DIR}/lib:" ${STAGING_AIDE_DIR}/aide.conf
+    sed -i -e "s:\@\@define LOGDIR.*:\@\@define LOGDIR ${STAGING_AIDE_DIR}/lib/logs:" ${STAGING_AIDE_DIR}/aide.conf
 }
 
 CONF_FILE = "${sysconfdir}/aide.conf"
@@ -38,7 +59,14 @@ CONF_FILE = "${sysconfdir}/aide.conf"
 FILES:${PN} += "${libdir}/${PN} ${sysconfdir}/aide.conf"
 
 pkg_postinst_ontarget:${PN} () {
-    /usr/bin/aide -i
+    if [ ${AIDE_SCAN_POSTINIT} ]; then
+        ${bindir}/aide -i
+    fi
+    if [ ${AIDE_RESCAN_POSTINIT}  && -e ${libdir}/aide/aide.db.gz ]; then
+        ${bindir}/aide -C
+    fi
 }
 
 RDEPENDS:${PN} = "bison libpcre"
+
+BBCLASSEXTEND = "native"

From patchwork Sat Jun 18 13:44:35 2022
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
X-Patchwork-Submitter: akuster808 <akuster808@gmail.com>
X-Patchwork-Id: 9320
X-Patchwork-Delegate: akuster808@gmail.com
Return-Path: <akuster808@gmail.com>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org
 (localhost.localdomain [127.0.0.1])
	by smtp.lore.kernel.org (Postfix) with ESMTP id 236FACCA473
	for <webhook@archiver.kernel.org>; Sat, 18 Jun 2022 13:44:59 +0000 (UTC)
Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com
 [209.85.216.52])
 by mx.groups.io with SMTP id smtpd.web11.9249.1655559894322607100
 for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:54 -0700
Authentication-Results: mx.groups.io;
 dkim=pass header.i=@gmail.com header.s=20210112 header.b=hVcmzlas;
 spf=pass (domain: gmail.com, ip: 209.85.216.52,
 mailfrom: akuster808@gmail.com)
Received: by mail-pj1-f52.google.com with SMTP id p5so676101pjt.2
        for <yocto@lists.yoctoproject.org>;
 Sat, 18 Jun 2022 06:44:54 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20210112;
        h=from:to:subject:date:message-id:in-reply-to:references:mime-version
         :content-transfer-encoding;
        bh=uBtorqjtfx3Um8itoKganr41+b4doQHcKOGYD76A0bY=;
        b=hVcmzlasTIfD7TRgE8DkQo+X+Mos3wnKnSYYJDJfbdfI/aPJAM791Jckgbx67WMIRW
         NHekt0y+Zonfj4uBhLUUa6pp8w5nfKX8gTLpN18wMTea/Rkxb/071sJYXZ7gyV7/b383
         iW9B0mFkQCI4yPk+uk+FT9tLZdk72mtP/wweZO4K5SISzsxtTGdjC3hhdPEaECE2xWdG
         DogAgGUdRX2QsXTWDUpxvlTcC6t6LgNthRrCp0wm97ozRp3nQ0ZQiA/MK0jwSedGIXFi
         RAcVfC5N0zW/Zcg5q+taHJVMJsm0c7COmgi1B5x0eaoFMgjg/mpw8JlNr8kqGujt6Eto
         +3qw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20210112;
        h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to
         :references:mime-version:content-transfer-encoding;
        bh=uBtorqjtfx3Um8itoKganr41+b4doQHcKOGYD76A0bY=;
        b=1hP/ONtz9Ln6cBm6R/LRlpNyjXzniZH3Fnb6s1/8Rrx++oR42zjEsKfPTCINR1iqMo
         XTeeug7ZMvXdfZxR6uvd4W3G7pE69PGIhtwDn1qf5be1zYHWkKkqWGXowTPU/XWII5F5
         IbQQ/3i/kFUWfloFrnCfXgwbkVkd3uEilDF04AG+rr7H0uwKgR/x44aSf7tHFdHUJYBp
         qnXWiMGfspIaT901+Imzu1pSM9EQrI/HFQVVhfFMFdBuTMjFSdAfu8zox8IA0WW9cUpJ
         jQ2LVCfvr4stF7M7HJz52gW+XCTVKUQnzETm04Qc6YdjDrHbqdNeFdcrajd+aYoDeDyM
         WGkQ==
X-Gm-Message-State: AJIora/uHc7mwlqJ1OjclJZGfFz0K7SDztf1ztKsl7KWs0woLOJdbYnb
	Cp9qTN3XIk+VbxcnloyXzBTuCiH/eA8=
X-Google-Smtp-Source: 
 AGRyM1vJq1DqIBbruea2eJAkt6jDfTnwsRxzBQEwwVOh5EX2duiccySa6Xfnd4RCIwsHUT+IXxyCGQ==
X-Received: by 2002:a17:902:d716:b0:169:78a:11d4 with SMTP id
 w22-20020a170902d71600b00169078a11d4mr12653385ply.90.1655559893454;
        Sat, 18 Jun 2022 06:44:53 -0700 (PDT)
Received: from keaua.hsd1.ca.comcast.net
 ([2601:202:4180:a5c0:b704:2c1c:4bb5:cab1])
        by smtp.gmail.com with ESMTPSA id
 o26-20020a63921a000000b00408a3724b38sm5689880pgd.76.2022.06.18.06.44.52
        for <yocto@lists.yoctoproject.org>
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Sat, 18 Jun 2022 06:44:52 -0700 (PDT)
From: Armin Kuster <akuster808@gmail.com>
To: yocto@lists.yoctoproject.org
Subject: [meta-security][PATCH 9/9] aide.conf: adjust to allow for build time
 db creation
Date: Sat, 18 Jun 2022 06:44:35 -0700
Message-Id: <20220618134435.2370878-9-akuster808@gmail.com>
X-Mailer: git-send-email 2.25.1
In-Reply-To: <20220618134435.2370878-1-akuster808@gmail.com>
References: <20220618134435.2370878-1-akuster808@gmail.com>
MIME-Version: 1.0
List-Id: <yocto.lists.yoctoproject.org>
X-Webhook-Received: from li982-79.members.linode.com [45.33.32.79] by
 aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for
 <yocto@lists.yoctoproject.org>; Sat, 18 Jun 2022 13:44:59 -0000
X-Groupsio-URL: https://lists.yoctoproject.org/g/yocto/message/57351

Signed-off-by: Armin Kuster <akuster808@gmail.com>
---
 recipes-ids/aide/aide/aide.conf | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/recipes-ids/aide/aide/aide.conf b/recipes-ids/aide/aide/aide.conf
index 2c99e07..c4b917e 100644
--- a/recipes-ids/aide/aide/aide.conf
+++ b/recipes-ids/aide/aide/aide.conf
@@ -51,7 +51,7 @@ report_url=stdout
 #crc32:  crc32 checksum (MHASH only)
 #whirlpool:     whirlpool checksum (MHASH only)
 
-FIPSR = p+i+n+u+g+s+m+c+acl+selinux+xattrs+sha256
+FIPSR = p+u+g+s+acl+xattrs+sha256
 
 #R:             p+i+n+u+g+s+m+c+acl+selinux+xattrs+md5
 #L:             p+i+n+u+g+acl+selinux+xattrs
@@ -70,10 +70,10 @@ EVERYTHING = R+ALLXTRAHASHES
 NORMAL = FIPSR+sha512
 
 # For directories, don't bother doing hashes
-DIR = p+i+n+u+g+acl+selinux+xattrs
+DIR = p+u+g+acl+xattrs
 
 # Access control only
-PERMS = p+i+u+g+acl+selinux
+PERMS = p+u+g+acl
 
 # Logfile are special, in that they often change
 LOG = >
@@ -83,12 +83,9 @@ LSPP = FIPSR+sha512
 
 # Some files get updated automatically, so the inode/ctime/mtime change
 # but we want to know when the data inside them changes
-DATAONLY =  p+n+u+g+s+acl+selinux+xattrs+sha256
+DATAONLY =  p+u+g+s+acl+xattrs+sha256
 
 # Next decide what directories/files you want in the database.
 
 # Check only permissions, inode, user and group for /etc, but
 # cover some important files closely.
-/bin NORMAL
-/sbin NORMAL
-/lib NORMAL